GHSA-2fhw-2j7m-mr4m
TYPO3 backend modules have Broken Access Control
At a glance
- Published
- Updated
- CVE
- CVE-2025-59017
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Description
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
Affected packages
| Package | Versions |
|---|---|
| Packagist · typo3/cms-workspaces | introduced 9.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 13.0.0, fixed 13.4.18 |
| Packagist · typo3/cms-recycler | introduced 9.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-recycler | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-recycler | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-recycler | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-recycler | introduced 13.0.0, fixed 13.4.18 |
| Packagist · typo3/cms-dashboard | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-dashboard | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-dashboard | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-dashboard | introduced 13.0.0, fixed 13.4.18 |
| Packagist · typo3/cms-beuser | introduced 13.0.0, fixed 13.4.18 |
| Packagist · typo3/cms-beuser | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-beuser | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-beuser | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-beuser | introduced 9.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-backend | introduced 9.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-backend | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-backend | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-backend | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-backend | introduced 13.0.0, fixed 13.4.18 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-59017 ADVISORY
- https://github.com/TYPO3-CMS/backend/commit/0aedf33d910bceafc2ed0e715743cc0d30124501 WEB
- https://github.com/TYPO3-CMS/beuser/commit/eb9b0c14a514a7aada8a2aa30e57696e286044c7 WEB
- https://github.com/TYPO3-CMS/dashboard/commit/582006c6bdf251160001eee6624901baccdcfcd2 WEB
- https://github.com/TYPO3-CMS/recycler/commit/43475578eb1d9fa3b765537c96bcdf48582ee53b WEB
- https://github.com/TYPO3-CMS/workspaces/commit/32222508043940f9073c338d4205c730a2e02070 WEB
- https://typo3.org/security/advisory/typo3-core-sa-2025-021 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |